[pull] master from Homebrew:master

.devcontainer/devcontainer.json

@@ -9,18 +9,36 @@
   "onCreateCommand": ".devcontainer/on-create-command.sh",
 
   "customizations": {
+    "codespaces": {
+      "repositories": {
+        "Homebrew/homebrew-bundle": {
+          "permissions": {
+            "contents": "write"
+          }
+        },
+        "Homebrew/homebrew-services": {
+          "permissions": {
+            "contents": "write"
+          }
+        }
+      }
+    },
     "vscode": {
       // Installing all necessary extensions for vscode
       // Taken from: .vscode/extensions.json
       "extensions": [
-        "kaiwood.endwise",
-        "lorankloeze.ruby-rubocop-revived",
-        "rebornix.ruby",
+        "Shopify.ruby-lsp",
         "sorbet.sorbet-vscode-extension",
         "github.vscode-github-actions",
-        "timonwong.shellcheck",
-        "foxundermoon.shell-format",
+        "anykeyh.simplecov-vscode",
+        "ms-azuretools.vscode-docker",
+        "github.vscode-pull-request-github",
         "davidanson.vscode-markdownlint",
+        "foxundermoon.shell-format",
+        "timonwong.shellcheck",
+        "ban.spellright",
+        "redhat.vscode-yaml",
+        "koichisasada.vscode-rdbg",
         "editorconfig.editorconfig"
       ]
     }

.devcontainer/on-create-command.sh

@@ -23,6 +23,9 @@ brew cleanup
 
 # actually tap homebrew/core, no longer done by default
 brew tap --force homebrew/core
+# tap some other repos so codespaces can be used for developing multiple taps
+brew tap homebrew/bundle
+brew tap homebrew/services
 
 # install some useful development things
 sudo apt-get update
@@ -38,11 +41,5 @@ apt_get_install \
   openssh-server \
   zsh
 
-# Ubuntu 18.04 doesn't include zsh-autosuggestions
-if ! grep -q "Ubuntu 18.04" /etc/issue &>/dev/null
-then
-  apt_get_install zsh-autosuggestions
-fi
-
 # Start the SSH server so that `gh cs ssh` works.
 sudo service ssh start

.github/workflows/actionlint.yml

@@ -18,14 +18,20 @@ env:
   HOMEBREW_NO_AUTO_UPDATE: 1
   HOMEBREW_NO_ENV_HINTS: 1
 
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+
 concurrency:
   group: "actionlint-${{ github.ref }}"
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions: {}
+
 jobs:
   workflow_syntax:
     if: github.repository_owner == 'Homebrew'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Set up Homebrew
         id: setup-homebrew
@@ -35,17 +41,45 @@ jobs:
           cask: false
           test-bot: false
 
-      - name: Set up actionlint
+      - name: Install tools
+        run: brew install actionlint shellcheck zizmor
+
+      - name: Set up GITHUB_WORKSPACE
         env:
           HOMEBREW_REPOSITORY: ${{ steps.setup-homebrew.outputs.repository-path }}
         run: |
-          brew install actionlint shellcheck
-
           # Annotations work only relative to GITHUB_WORKSPACE
           (shopt -s dotglob; rm -rf "${GITHUB_WORKSPACE:?}"/*; mv "${HOMEBREW_REPOSITORY:?}"/* "$GITHUB_WORKSPACE")
           rmdir "$HOMEBREW_REPOSITORY"
           ln -vs "$GITHUB_WORKSPACE" "$HOMEBREW_REPOSITORY"
 
           echo "::add-matcher::.github/actionlint-matcher.json"
 
+      - run: zizmor --format sarif . >results.sarif
+
+      - name: Upload SARIF file
+        uses: actions/upload-artifact@v4
+        with:
+          name: results.sarif
+          path: results.sarif
+
       - run: actionlint
+
+  upload_sarif:
+    needs: workflow_syntax
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Download SARIF file
+        uses: actions/download-artifact@v4
+        with:
+          name: results.sarif
+          path: results.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor

.github/workflows/autogenerated-files.yml

@@ -16,9 +16,13 @@ env:
   HOMEBREW_DEVELOPER: 1
   HOMEBREW_NO_AUTO_UPDATE: 1
 
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+
 jobs:
   autogenerated:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     if: github.repository == 'Homebrew/brew'
     steps:
       - name: Set up Homebrew
@@ -30,7 +34,7 @@ jobs:
           test-bot: true
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@v4
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}

.github/workflows/codeql-analysis.yml

@@ -8,26 +8,32 @@ on:
     branches:
       - master
 
+defaults:
+  run:
+    shell: bash -xeuo pipefail {0}
+
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3
         with:
           languages: ruby
           config: |
             paths-ignore:
               - Library/Homebrew/vendor
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3